From 5441a158937b5b4749a69c5d9ebaf8ba425af152 Mon Sep 17 00:00:00 2001
From: Thomas Piccirello <tom.p@posthog.com>
Date: Tue, 4 Aug 2026 16:16:01 -0700
Subject: [PATCH] fix(ci): sign the commits this workflow creates

Commits created with plain git are unsigned and are rejected by the
org-wide signed-commits ruleset. Route them through the GitHub API so
GitHub signs them with its own key.
---
 .github/workflows/release.yml | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 23243cc..d979b87 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -67,7 +67,7 @@ jobs:
         permissions:
             contents: write
         outputs:
-            committed: ${{ steps.commit-version-bump.outputs.committed }}
+            committed: ${{ steps.check-changes.outputs.committed }}
             new-version: ${{ steps.apply-changesets.outputs.new-version }}
         steps:
             - name: Notify Slack - Approved
@@ -118,22 +118,30 @@ jobs:
             - name: Update lockfile
               run: pnpm install --no-frozen-lockfile
 
-            - name: Commit version bump and lockfile
-              id: commit-version-bump
-              env:
-                  GITHUB_TOKEN: ${{ steps.releaser.outputs.token }}
-                  NEW_VERSION: ${{ steps.apply-changesets.outputs.new-version }}
+            - name: Check for a version bump to commit
+              id: check-changes
               run: |
-                  git add -A
-                  if git diff --staged --quiet; then
+                  if [ -z "$(git status --porcelain)" ]; then
                     echo "No changes to commit"
                     echo "committed=false" >> "$GITHUB_OUTPUT"
                   else
-                    git commit -m "chore: release ${NEW_VERSION} [version bump]"
-                    git push origin main
                     echo "committed=true" >> "$GITHUB_OUTPUT"
                   fi
 
+            # Commits through the GitHub API so it carries GitHub's signature, which
+            # the org-wide signed-commits ruleset requires. A plain `git push` is
+            # rejected.
+            - name: Commit version bump and lockfile
+              id: commit-version-bump
+              if: steps.check-changes.outputs.committed == 'true'
+              uses: planetscale/ghcommit-action@a6b150b81dca5dd027baa898604418eec9e11465 # v0.2.22
+              with:
+                  commit_message: 'chore: release ${{ steps.apply-changesets.outputs.new-version }} [version bump]'
+                  repo: ${{ github.repository }}
+                  branch: main
+              env:
+                  GITHUB_TOKEN: ${{ steps.releaser.outputs.token }}
+
     notify-rejected:
         name: Notify Slack - Rejected
         needs: [version-bump, notify-approval-needed]